A Traffic Monitoring Method for High Speed Networks

Abnormal traffic that causes various problems on the Internet, such as P2P flows, DDoS attacks, and Internet worms, is increasing; therefore, the importance of methods that identify and control abnormal traffic is also increasing. Though the application of frequent-itemset-mining techniques is a promising way to analyze Internet traffic, the huge amount of data on the Internet prevents such techniques from being effective. The limitation of DRAM memory access speed makes this problem further difficult. To overcome this problem, we have developed a simple frequent-itemset-mining method that uses only a small amount of memory but is effective even with the large volumes of data associated with broadband Internet traffic. We show that our method can analyze host's behavior and find P2P software, spams, and scans in Internet traffic. In this paper, a hash-based packet aggregation method and a multi-thread cardinality analysis method are proposed to achieve real-time analyzing ability for 13-Gbps networks.